Deepfake KYC Fraud in Crypto: Attacks and Defences (2026)

The numbers

Finding	Source
Deepfakes in 1 in 5 biometric fraud attempts	Entrust 2026 report (1bn+ verifications, 195 countries)
Deepfaked selfies up 58% in 2025	Entrust 2026 report
Injection attacks up 40% year on year	Entrust 2026 report
A deepfake attempt every five minutes in 2024; digital document forgeries up 244%	Entrust 2025 report
Sophisticated multi-step fraud up 180%; overall fraud rate 2.2% (from 2.6%)	Sumsub 2025–2026 report
AI-generated documents: 2% of detected fakes	Sumsub 2025–2026 report
Gen-AI-enabled US fraud losses: $12.3bn (2023) to $40bn (2027, projected)	Deloitte

Sources: Entrust, 18 November 2025; Infosecurity Magazine on Entrust's 2025 report; Sumsub, 25 November 2025. These are vendors' own datasets, so read them as direction rather than precise market measures.

The pattern across both datasets is the same: total fraud attempts are flat or falling as basic checks improve, while the attacks that remain are better resourced and harder to catch.

Why crypto is a target

A verified crypto account can receive, convert and send value across borders in minutes. That makes it worth more to criminals than most other accounts, and it is why fraudsters invest in deepfakes to open them.

Typical uses are money-mule accounts for scam proceeds, accounts opened in other people's names to cash out stolen funds, and sign-up bonus farming. Impersonation is growing alongside: The Next Web, citing Chainalysis, reported that crypto impersonation scams grew more than 1,400% in 2025 (TNW). Those scams often end in exactly the kind of mule account a deepfake KYC attack opens.

How the attacks work

• Presentation attacks. The old approach: showing a printed photo, a screen or a mask to the camera. Still common and still caught by basic liveness.
• Face swaps. Real-time software maps a stolen identity's face onto the fraudster's own, so the video moves naturally and responds to prompts.
• Injection attacks. The camera is bypassed. A virtual camera driver, an emulator or a rooted phone feeds pre-recorded or generated video into the app as though it came from the lens. Liveness checks that only analyse the image can be fooled because the image itself looks perfect.
• AI-made documents. Generated or edited ID images with plausible fonts, holograms and photos. Sumsub found these were 2% of fakes it detected in 2025, a small but new category.
• Synthetic identities. A real ID number combined with invented details and a generated face, built up over time to look like a genuine person.

The defences that work

No single check stops all of these. The vendors with the best results combine liveness detection, injection detection, document-chip verification and human review, so that an attacker has to beat every layer at once.

1. Liveness detection. Checks that a live person is present now, using depth, texture and movement. 3D liveness analyses the face's shape rather than a flat image.
2. Injection and device integrity. Detects virtual cameras, emulators, rooted devices and tampered SDKs, and checks that the video really came from the device's camera.
3. NFC chip reading. Modern passports and many ID cards carry a chip whose data is signed by the issuing state. Reading it with the phone and checking the signature proves the document is genuine, and the chip photo can be matched to the selfie. A generated image cannot produce a valid chip.
4. Cross-checks. Duplicate faces across accounts, the same device behind many sign-ups, proxies and VPNs, and sanctions and PEP lists.
5. Human review. Trained reviewers for cases the models are unsure about.

How vendors respond: iDenfy as an example

iDenfy, a KYC company founded in 2017 in Kaunas, Lithuania, layers several of these defences: 3D liveness built on FaceTec technology since 2020, optional or mandatory NFC chip reading, proxy detection and fraud scoring, and human reviewers who check automated decisions.

Making NFC mandatory is the strongest single setting against generated documents: in iDenfy's configuration, a verification is denied if the user fails to scan a chip-enabled document (iDenfy docs). Its billing model also matters here: iDenfy says it charges only for approved verifications, so the fraudulent attempts it blocks do not add to the client's bill. Other vendors in our KYC provider comparison offer comparable layers; ask each which injection-detection methods they use and which liveness certifications they hold.

A checklist for crypto platforms

• Ask your vendor for injection-attack test results, not only presentation-attack certifications.
• Require NFC chip reading for document types that support it, at least for high-risk tiers.
• Block or step up verification for emulators, virtual cameras and rooted devices.
• Monitor for the same face or device across many accounts.
• Re-verify on risk signals, such as a new device followed by a large withdrawal.
• Track cost per approved, genuine user, not cost per check.

The regulatory angle

Regulators do not prescribe a liveness technology, but they hold firms responsible for verification that actually works. In the EU, the Anti-Money Laundering Regulation that applies from July 2027 sets common customer due diligence rules for crypto service providers, and the EU's digital identity wallets will give firms a state-issued alternative to photographing documents. In Singapore, the Monetary Authority's licensing regime for digital token service providers, in force since June 2025, expects the same standard of identity checks from crypto firms as from other payment institutions. A platform whose onboarding is beaten by off-the-shelf face-swap tools is a platform with a compliance failure, not just a fraud loss. These questions will be on the agenda at the Singapore FinTech Festival on 18–20 November; see RegTech trends in 2026.

What it means for users

Expect to be asked to scan your passport chip, turn your head or hold the phone closer. Those steps exist because deepfakes beat simpler checks. For self-custody DeFi users, KYC happens only at on- and off-ramps; inside protocols, the risks are different, and we cover them in DeFi risks. On Stellar, the ramp check runs through the anchor's KYC API; see how KYC works on Stellar anchors.